[Guardian] Pin attestation PCR0 via a per-build allowlist

[mskd12]

⚠️ Draft / do not merge. Stacked on #666 (base = its branch) — review/merge #666 first; this rebases onto main once it lands. #666 itself is blocked on fastcrypto #971.

Replaces #666's single config PCR0 with a per-build allowlist, completing IOP-225 check C. Verification resolves the build named by the session's signature-verified untrusted_git_revision and pins the attestation's PCR0 to it; an unknown build is rejected (we don't know its measurements, so we can't trust it).

Allowlist — capped at two builds

struct PcrAllowlist { expected_build: BuildPcrs, prev_build: Option<BuildPcrs> }

• expected_build is the build we run; prev_build is the outgoing image, set only during an upgrade window so its still-running sessions verify until they rotate.
• The 1..=2 cap is a type invariant (one mandatory + one optional) — 0 or 3+ builds are unrepresentable, so allowlist rot is impossible: a retired, possibly-broken PCR can't linger across upgrades.

Targeted by source

resolve(revision, source) — the live enclave must be expected_build; historical S3 logs may also come from prev_build:

• GetGuardianInfoResponse::verify (relay GetGuardianInfo, hashi-node queries) → LiveEnclave, so you can never provision/act on a stale enclave.
• get_enclave_identity (the GuardianReader S3 path: prior withdrawals, old committee) → HistoricalLog.

The lookup happens inside verify_enclave_attestation (prod branch), so non-enclave-dev/test stays a complete no-op — dev configs never enumerate a revision.

Read-path consolidation

• get_verified_enclave_pubkey → get_enclave_identity: reads the AWS-self-signed attestation (anchoring the signing pubkey), then the signed GuardianInfo (sig-checked under that pubkey → reported build), then pins PCR0.
• The session cache (GuardianSessionKeyCache → GuardianSessionCache) holds the whole EnclaveIdentity { signing_pubkey, info }, so get_info is a cache hit instead of a second S3 read.

Config

expected_pcr0: String → expected_build (+ optional prev_build), each { git_revision, pcr0 }, via the shared BuildPcrsConfig; a flat map couldn't label which entry is expected vs outgoing. Threaded through provisioner + monitor (configs + sample YAMLs + README). Dropped the now-unused hex dep from hashi-monitor.

Trust ordering

Attestation cert-chain → anchor pubkey → info signature under it → PCR0 pinned to the named build. Selecting the build by the self-reported revision can't be gamed: PCR0 is the real attested image hash, so a wrong revision resolves to a PCR0 the real image won't match. Side effect: after this, untrusted_git_revision is bound to the attested image.

Notes

• Kept OIAttestationUnsigned and OIGuardianInfo as separate logs — the attestation is AWS-self-signed (its own root of trust), so it stays unsigned.
• No test/e2e path drives the reader (e2e uses in-process install_operator_init_for_testing); bootstrap_guardian uses signed_info.verify directly. Every session logs OIGuardianInfo before any traffic, so the commit is always available.
• The provisioner's current-session get_info is HistoricalLog (permissive); the authoritative "expected build" gate is the relay precheck it submits the share through.

🤖 Generated with Claude Code